Full Disclosure mailing list archives

A CSV Injection vulnerability exists in iDempiere WebUI
v12.0.0.202508171158. The application fails to properly sanitize
user-supplied input before including it in exported CSV files. An
authenticated attacker can inject malicious spreadsheet formulas
(e.g., =cmd|'/C
notepad'!A1) into fields that are later exported. When the CSV is opened in
spreadsheet software such as Microsoft Excel or LibreOffice Calc, the
injected formula is executed. Successful exploitation may allow arbitrary
command execution on the victim’s workstation, data exfiltration via
external cell references, or manipulation of the exported spreadsheet
content.

*Request:*

POST /webui HTTP/2

Host: <host>

-

dtid=******&cmd_0=onInitEdit&data_0=%7B%22value%22%3A%22%3Dcmd%7C'%20%2FC%20notepad'!'A1'%22%7D&cmd_1=onBlur
--snip--



*Response:*

HTTP/2 200 OK

-


{"rs"--snip--: =cmd|\' /C
notepad\'!\'A1\'',iconSclass:'z-icon-Window'},{},[]],
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• CSV Injection in iDempiere WebUI 12.0.0.202508171158 Ron E (Aug 18)